UBUNTU-CVE-2022-24686
Dashboard / Vulnerabilities / UBUNTU-CVE-2022-24686
Summary:
Details: HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6
References: https://ubuntu.com/security/CVE-2022-24686, https://discuss.hashicorp.com, https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559, https://www.cve.org/CVERecord?id=CVE-2022-24686
Affected packages
Package
Name: nomad
Purl: pkg:deb/ubuntu/[email protected]+dfsg-1?arch=source&distro=bionic
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
0.4.0+dfsg-1
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
